Government and public statistics

Regulation (EU) 2016/679 (General Data Protection Regulation), recitals

Official Journal of the European Union (EUR-Lex), 2016

Read on October 17, 2026

What it is: The official text of the EU General Data Protection Regulation. Recital 26 explains that personal data which has been pseudonymised, and can be linked back to a person with additional information, still counts as personal data.
How much weight it carries: The binding legal text published by the EU, so it is the primary source for what the law says. Recitals explain the articles but do not themselves create obligations. Whether a given product is compliant is a separate question this source does not answer.

Facts taken from this source

Under the EU GDPR, processing personal data is lawful only if and to the extent that at least one of the listed conditions applies, and consent is one of them.
“Processing shall be lawful only if and to the extent that at least one of the following applies” (Article 6(1))
Under the EU GDPR, personal data that has been pseudonymised still counts as information about an identifiable person when it can be attributed to that person with additional information.
“Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.” (Recital 26)

Government and public statistics

Official Journal of the European Union (EUR-Lex), 2016

Read on October 17, 2026

What it is: The official text of the EU General Data Protection Regulation. Recital 26 explains that personal data which has been pseudonymised, and can be linked back to a person with additional information, still counts as personal data.
How much weight it carries: The binding legal text published by the EU, so it is the primary source for what the law says. Recitals explain the articles but do not themselves create obligations. Whether a given product is compliant is a separate question this source does not answer.

Under the EU GDPR, processing personal data is lawful only if and to the extent that at least one of the listed conditions applies, and consent is one of them.
“Processing shall be lawful only if and to the extent that at least one of the following applies” (Article 6(1))
Under the EU GDPR, personal data that has been pseudonymised still counts as information about an identifiable person when it can be attributed to that person with additional information.
“Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.” (Recital 26)